Proposal: Non-streaming encryption api

[calvinmetcalf]

The steaming format is a poor fit for authenticated ciphers so one idea would be to make a new non streaming api for encryption (maybe just authenticated encryption?) to avoid situations where we are decrypting data we have not authenticated.

This would also allow us to impliment ccw mode which I seem to recall having issues related to needing to know the message length ahead of time.

I can try throwing together a pull if people like this idea.

[mikeal]

+1

[domenic]

Might be a different issue (maybe spin it off into NG if so) but I'd be curious to see to what extent your thinking aligns with web crypto's APIs.

[calvinmetcalf]

I don't think think we need to have such complex key management objects and
I'd probably want the parameters to be slightly more consistent (all in an
object or none in an object), Plus we'd need a synchronous version not just
an async version. I've found, in general, that the subtle crypto api is
way too complex.

On Wed, Feb 25, 2015 at 12:32 AM Domenic Denicola notifications@github.com
wrote:

Might be a different issue (maybe spin it off into NG if so) but I'd be
curious to see to what extent your thinking aligns with web crypto
https://dvcs.w3.org/hg/webcrypto-api/raw-file/tip/spec/Overview.html's
APIs.

—
Reply to this email directly or view it on GitHub
#941 (comment).

[calvinmetcalf]

wait nope, probably not able to do this myself, don't know enough c++ and got stuck trying to figure out where ctx_ was defined.

[seishun]

Most of crypto is synchronous. You can just easily write non-streaming wrappers in JS-land. Or are you talking about some specific crypto function where this wouldn't work?

[calvinmetcalf]

ccm mode doesn't work currently due to the streaming nature

[Trott]

Is this basically in a "waiting for someone to implement it" state?

@nodejs/crypto

[bnoordhuis]

That, and the API needs to be hashed out.

[bnoordhuis]

I'll go ahead and close out this issue. It's been open for 2.5 years with no movement whatsoever; the last comment was my own and that was over a year ago.